diff options
| -rw-r--r-- | cmd/podman/root.go | 8 | ||||
| -rw-r--r-- | libpod/container_internal_linux.go | 10 | ||||
| -rw-r--r-- | test/system/001-basic.bats | 7 | ||||
| -rw-r--r-- | test/system/410-selinux.bats | 28 |
4 files changed, 51 insertions, 2 deletions
diff --git a/cmd/podman/root.go b/cmd/podman/root.go index 2b77afbeb..4527c2646 100644 --- a/cmd/podman/root.go +++ b/cmd/podman/root.go @@ -180,6 +180,10 @@ func persistentPreRunE(cmd *cobra.Command, args []string) error { os.Setenv("TMPDIR", "/var/tmp") } + context := cmd.Root().LocalFlags().Lookup("context") + if context.Value.String() != "default" { + return errors.New("Podman does not support swarm, the only --context value allowed is \"default\"") + } if !registry.IsRemote() { if cmd.Flag("cpu-profile").Changed { f, err := os.Create(cfg.CPUProfile) @@ -269,6 +273,10 @@ func rootFlags(cmd *cobra.Command, opts *entities.PodmanConfig) { lFlags.StringVar(&opts.URI, urlFlagName, uri, "URL to access Podman service (CONTAINER_HOST)") _ = cmd.RegisterFlagCompletionFunc(urlFlagName, completion.AutocompleteDefault) + // Context option added just for compatibility with DockerCLI. + lFlags.String("context", "default", "Name of the context to use to connect to the daemon (This flag is a NOOP and provided solely for scripting compatibility.)") + _ = lFlags.MarkHidden("context") + identityFlagName := "identity" lFlags.StringVar(&opts.Identity, identityFlagName, ident, "path to SSH identity file, (CONTAINER_SSHKEY)") _ = cmd.RegisterFlagCompletionFunc(identityFlagName, completion.AutocompleteDefault) diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index d167bf188..4fc45e4f0 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { case "z": fallthrough case "Z": - if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { - return nil, err + if c.MountLabel() != "" { + if c.ProcessLabel() != "" { + if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { + return nil, err + } + } else { + logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID()) + } } default: diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats index d276cfda1..081bb1171 100644 --- a/test/system/001-basic.bats +++ b/test/system/001-basic.bats @@ -10,6 +10,13 @@ function setup() { : } +@test "podman --context emits reasonable output" { + run_podman 125 --context=swarm version + is "$output" "Error: Podman does not support swarm, the only --context value allowed is \"default\"" "--context=default or fail" + + run_podman --context=default version +} + @test "podman version emits reasonable output" { run_podman version diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats index 4a2c7b7a4..8a690fb48 100644 --- a/test/system/410-selinux.bats +++ b/test/system/410-selinux.bats @@ -191,5 +191,33 @@ function check_label() { is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic" } +@test "podman selinux: check relabel" { + skip_if_no_selinux + + LABEL="system_u:object_r:tmp_t:s0" + tmpdir=$PODMAN_TMPDIR/vol + touch $tmpdir + chcon -vR ${LABEL} $tmpdir + ls -Z $tmpdir + + run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ ${tmpdir} + is "$output" ${LABEL} "No Relabel Correctly" + + run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ $tmpdir + is "$output" ${LABEL} "No Privileged Relabel Correctly" + + run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ $tmpdir + is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly" + + run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current + run ls -dZ $tmpdir + is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly" +} # vim: filetype=sh |